The vulnerability in the FRESHFACE Custom CSS plugin is a Missing Authorization flaw that allows exploitation of incorrectly configured access control levels. An attacker can use the plugin’s CSS editing functionality without proper authentication or authorization checks. This can lead to unauthorized modifications of the site’s appearance by changing CSS styles, thereby compromising the site’s integrity and trustworthiness.

The affected product is the FRESHFACE Custom CSS plugin for WordPress. All installations of version 1.4.0 or earlier are vulnerable. No other vendors or products are implicated.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of < 1% reflects a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web-based attack where an authenticated WordPress user, possibly with minimal privileges, can access the plugin’s features and perform unauthorized modifications. Based on the description, this results in unauthorized changes to the site's CSS, potentially impacting the site’s appearance and user trust.